topic List of AD groups a user was removed from in Splunk Search

List of AD groups a user was removed from

toontech — Sun, 27 Dec 2020 12:17:12 GMT

How do I get a list of AD groups a specific user was removed from in the last week please.

We had a Helpdesk person accidentally remove AD groups for a user far earlier than they should have and whilst we can re-instate some memberships via user location, department knowledge etc there will be a lot more than that.

Any ideas please?

Re: List of AD groups a user was removed from

richgalloway — Sun, 27 Dec 2020 15:34:19 GMT

Search for EventCode=4729 and the user in question.

Re: List of AD groups a user was removed from

toontech — Tue, 29 Dec 2020 12:35:17 GMT

thank you for this, it appears we are not logging events for this code in Splunk. We had to make a manual effort to restore this users AD groups and I guess i'll have to ask for such events to be logged in future.

Re: List of AD groups a user was removed from

gazzadownunder — Tue, 17 Aug 2021 11:11:57 GMT

Have a look at this article, which shows how to display group membership changes for a user based on AD replication data.

https://nettools.net/group-changes/

And this one which shows the members that have been removed from an individual group

https://nettools.net/howto-display-what-members-were-remove-from-a-group/